Method for refreshing encrypted messages for homomorphic cryptography and homomorphic cryptography method

Abstract

The invention relates to a method for refreshing an encrypted message (I) in order to obtain a new version of an encrypted message c ', p being an unencrypted message, where b = [mu] + e + a.s, where: s is a secret key vector comprising n elements; a is a projection vector of the secret key s; c'comprises a random noise component e 'with an absolute value smaller than that of the noise e; the method comprises: a step of performing a homomorphic calculation of (II), wherein: (III) is a function refresh polynomial; vector a corresponds to an approximate estimate of 2N (b-a.s), including a sum of terms, each term including a rounding (IV) of a partial sum equal to a scalar product of vector (V) and vector (VI), vector (VI) including m ordered elements of vector a, and (VII) including m corresponding ordered elements of vector s.

Description

Technical Field

[0001] The technical field involves homomorphic cryptography methods, devices, and systems. Background Technology

[0002] Homomorphic cryptography has attracted much attention in recent years. This technology allows computation or data processing to be performed on encrypted data without first decrypting it.

[0003] In fact, the digital processing of personal data has now permeated every corner of our daily lives. Therefore, protecting the confidentiality of this data and the personal privacy involved has become crucial, as personal data flows more and more frequently in the digital systems we use every day.

[0004] In this context, homomorphic encryption and processing techniques appear to be a very promising solution because they allow data to be processed while preserving the anonymity and privacy of that data in an extremely secure manner, since the data is not decrypted during processing.

[0005] Therefore, homomorphic cryptography methods, among other things, also face the following technical challenges, including implementation:

[0006] External (usually remote) service and processing servers perform "blind" operations on encrypted data without decrypting it because the server does not have the key required to decrypt the data;

[0007] - The encrypted data is provided by another entity (the client in IT terminology) that possesses the encryption key.

[0008] These data processing operations can include performing individual operations on a data-by-data basis, such as formatting or filtering. They can also involve operations such as comparing, sorting, or grouping the data.

[0009] Homomorphic cryptography can be based on the "Learn with Error" (LWE) encryption scheme, in which the encrypted message... The following formula is derived from the unencrypted message μ: b = μ + e + as, where:

[0010] -s is the secret key.

[0011] -a is a randomly chosen vector used to project the secret key s, and

[0012] -e is the random noise component added to μ+as.

[0013] To decrypt the message, the person possessing the secret key *s* can compute *ba.s* (equal to *μ* + *e*), then round the result to remove the noise component *e* and recover the message *μ*. Of course, for the message *μ* to be recovered, the noise term *e* must be sufficiently small and remain sufficiently small.

[0014] When two encrypted messages are added together, an encrypted message is obtained, which is an encrypted version of the sum of the two initial unencrypted messages, and its noise component is higher than that of the two initial encrypted messages.

[0015] Therefore, to prevent noise from increasing and growing during data processing, the refresh process is repeated, often referred to as "bootstrapping". This process produces a bootstrapping version of c, i.e., the encrypted message c′, which is also decrypted into μ (when decrypted using s), but its noise component is smaller than that of c.

[0016] The guiding process typically includes the quantity X α .v(X) is used for homomorphic estimation, where:

[0017] -v(X) is a function-guided polynomial with a degree less than or equal to N-1, and its coefficients are selected based on the characteristics of the message space and the objective function.

[0018] -And α is the integer closest to 2N(ba.s):

[0019]

[0020] Regarding homomorphic estimation here, it refers to computation using cryptographic quantities without prior decryption (no need to know the key s). Regarding the objective function here, it refers to the mathematical function applied simultaneously with the bootstrapping to the encrypted message. In the case of simple refresh, the objective function is the identity function.

[0021] For a properly chosen polynomial v(X), X α .v(X)mod(X N +1) is the constant term, i.e., coef0(X) α .v(X)) is the bootstrap version of c, i.e. the encrypted version of μ, which has a finite noise component e′ (usually smaller than the noise component of c when c is the result of a previous homomorphic data processing operation; in any case, e′ is small enough to allow decryption of c′ with a low error rate).

[0022] According to the known method, the quantity coef0(X) α .v(X))=X α .v(X)mod(X N The homomorphic computation of +1) can be decomposed into the computation of the following modular sequence:

[0023]

[0024] in and

[0025] Where s k These are the n components of vector s. In the above formula, when performing homomorphic computation, each product "." is a modular multiplication: the terms on the left, for example... or belong And the terms on the right, such as v(X) or Belongs to T N [X]. Here, T is defined. N [X] = T[X] / (X) N +1). Such a product is similar to the product y.μ. i y is an integer, and μ belongs to T (but the work is done on the polynomial field rather than the number field).

[0026] Because there is an unknown secret key s, therefore coef0(X) α Homomorphic computation of .v(X) is not immediate. However, it is known that , such as y.μ i or X j Modular products like .v(X) can be defined by defining an outer product. To perform homomorphic computation. Quantity It is message μ i The encrypted version. Quantity χ S′ (z) is the “TRGSW” encryption of z (the abbreviation TRGSW comes from “Gentry, Sahai, Waters Torus Ring Encryption”, adapted from the encryption method provided by C. Gentry, A. Sahai, and B. Waters in the InCrypto’13, 2013 paper “Homomorphic encryption from learning with errors: Conceptually-simpler, asymptotically-faster, attribute-based”).

[0027] Furthermore, in a known manner, it is possible to obtain the components s of the secret key without knowing the secret key. k Calculate the product without knowing the secret key s, k = 1...n.

[0028] In fact, due to component s kThe numbers k = 1...n each belong to B = {0, 1} (that is, they are all binary), therefore the quantity... equal It is encrypted as

[0029] As a result, without accessing the secret key s, the encrypted version X of component sk can be used. s ′(s k Calculate X α .v(X)mod(X N +1) encrypted version. These encrypted versions of the s component are sometimes referred to as the bootstrap key BK. k =χ S′ (s k The bootstrap key (usually public) is a component of the secret key s that is encrypted using another key s′. k The encrypted version.

[0030] χ S′ (y) is defined as equal to Z + yH B ,in:

[0031] - Where z j j = 1...l(K+1), which are l(K+1) encrypted versions of 0, with the zero value 0 encrypted using s′: l is a given positive integer; and

[0032] -H B It is a matrix of dimension (K+1)×(K+1)×l, and its coefficients belong to the torus T. equal:

[0033] in

[0034] B is an integer greater than or equal to 2.

[0035] The external product between the following items is calculated using the method detailed below.

[0036] - Encrypted messages Corresponding to the torus T N [X] message μ;

[0037] - An encrypted version of a polynomial with integer coefficients y

[0038] Encrypted messages The K+1 components c j j = 1..K+1 can be obtained by using a system with B as its base (such as those used to calculate χ).S′ The system is decomposed in some way.

[0039]

[0040] Then, calculations can be performed.

[0041]

[0042] Where ∑ B，l (c) C is the product of rows and columns, and ∑ B，l (c) is a matrix of dimension (n+1)×l, in the following form:

[0043] ∑ B，l (c)=(σ B，l (c1), ..., σ B，l (c j ), ..., σ B，l (c n+1 ))

[0044] in

[0045] result Belongs to T n+1 Furthermore, it is an encrypted version of y.μ. In other words, y.μ can be obtained by decrypting this quantity using the key s′. This calculation method can be applied to any message belonging to the torus T.

[0046] Use the key BK described above. i This allows us to obtain the results for coef0(X). α The homomorphic computation of .v(X) is given by the following formula, namely

[0047]

[0048] Therefore, the above formula allows for refreshing or bootstrapping encrypted messages without needing to know the encryption key.

[0049] The bootstrapping operation is extremely useful and allows for the implementation of homomorphic cryptography without the gradual loss of encrypted information to noise during processing. However, it is a complex operation requiring substantial computational resources (in practice, its complexity often proves to be a major obstacle to the development of homomorphic cryptography applications). Furthermore, it is crucial that the operation be highly reliable (i.e., with a low risk of losing initial information).

[0050] Certain parameters, such as the degree N of the polynomial used, or the standard deviation of the noise components initially added to the message during encryption, can affect the amount of computation to be performed (if the standard deviation is large, the message must be "refreshed" more frequently). However, they can also affect encryption security (if the standard deviation involved is large, the encrypted information is better protected) or the risk of information loss.

[0051] Therefore, in this context, it is necessary to improve the performance of the boot process (in terms of computation or reliability). Summary of the Invention

[0052] To at least partially address the problems discussed above, the present invention relates to a method for homomorphically guided encrypted messages that is more reliable and whose implementation does not require excessively increased computational complexity.

[0053] The first aspect of the present invention relates to a method for guiding encrypted messages. In order to obtain a new version of the encrypted message c′, where μ is the plaintext message, b = μ + e + as, where:

[0054] -s is a vector containing n elements from a finite set of integers S, and s is the secret key used to encrypt the message μ;

[0055] -a is a vector containing n randomly selected elements, and a is the projection vector of the secret key s;

[0056] -e is the random noise component added to μ+as;

[0057] -c′ includes random noise components e′ whose absolute value is less than the noise e;

[0058] The method includes homomorphic computation of polynomial X. α The zeroth-order coefficients of v(X) are coef0(X). α The steps of .v(X)), where:

[0059] -v(X) belongs to modulo 1+X N The function-guided polynomial of the defined set of polynomials;

[0060] - The quantity α corresponds to an approximate estimate of 2N(ba.s), where N is an integer. This approximate estimate comprises the sum of terms, each term including a vector. with vector Rounding of equal scalar products Includes m ordered elements of vector a, and It includes m corresponding ordered elements of vector s, where k is between 2 and the integer part of n / m.

[0061] Based on the existing guiding method, the calculation of polynomial X is used. α The zero coefficient of v(X). This calculation is approximate because the quantity It is the sum of monomials rounded down, which is actually calculated by rounding the sum:

[0062] The method according to the invention is based on different and more reliable approximations of the quantity α. The rounded sum of partial sums according to the invention is more effective than the estimation of the sum of individual terms rounded according to prior art.

[0063] The method according to the invention includes the step of calculating α as a rounded sum of partial sums. This calculation step is performed using a computing device (e.g., an example of a computing module). Each partial sum includes a vector. sum vector Rounding of the scalar product. Vector. Includes the m ordered elements of vector a. Vector Includes the m ordered elements of vector s. Vector and The index k appears between 1 and the integer part of n / m, where m is the size of vectors a and s.

[0064] In other words, the method according to the invention involves grouping (or “folding”) vectors a and s to form subvectors of size m, where m is less than n. Therefore, rounding is performed on each scalar product. This technique reduces rounding-related errors and thus makes the guiding process more reliable compared to existing techniques.

[0065] For example, when n is divisible by m, the folding of vectors a and s can be described as follows:

[0066]

[0067] When m=3, the first element group in the folding of vector s is: Perform a similar folding on vector a to obtain the term

[0068] Regarding the guided polynomial of a function, it refers to the polynomial that allows a function to be known in a certain way. A polynomial that performs bootstrapping or refresh operations on an encrypted message. The coefficients of this polynomial are chosen based on the encrypted message space and the properties of the function f. Furthermore, the bootstrapping polynomial allows the function f to be applied to the encrypted message c(a, b) to obtain the bootstrapping message c′ = f(c). If only bootstrapping of the encrypted message is desired, the function f can be considered an identity function.

[0069] Regarding the logarithm coef0(X) αHomomorphic computation is performed using v(X), which means computation performed using public encryption of key s or using a bootstrap key. According to one embodiment of the method of the present invention, the bootstrap key has a function... The public ciphertext form is encrypted using the secret key s′. Here, regarding... It refers to the Kronecker delta function, which when It equals 1 in some cases and zero in others. One advantage of this invention is that it improves the reliability of the boot process without unduly increasing its complexity.

[0070] More specifically, for m = n, there exists an accurate estimate of the quantity α. For m = 1, there exists an approximate estimate based on existing techniques. Therefore, the present invention is particularly advantageous for intermediate values ​​of the folding parameter m, as reliable homomorphic guidance can be obtained without unduly increasing computational complexity.

[0071] According to an embodiment of the first aspect of the present invention, the approximate calculation of the quantity α includes a homomorphic estimation using the following formula:

[0072]

[0073] in Calculated as function In computation, it is a publicly encrypted form, where And S mm It is a set of tuples of size m whose values ​​are in S.

[0074] According to an embodiment of a first aspect of the invention, the guiding method includes the step of homomorphically estimating n / m modulo product sequences, the sequences being given by the following formula:

[0075]

[0076] Juzhong Where k = 1, 2, ..., n / m, H k (X) is in a publicly encrypted form during computation.

[0077] According to an embodiment of a first aspect of the present invention, the guiding method includes receiving Public encrypted version The encryption step is performed using the key s′. This allows for encryption of the quantity X. α Use v(X) for homomorphic estimation.

[0078] According to an embodiment of a first aspect of the present invention, the bootstrapping method includes the following steps: based on the secret key s, using TLWEs(coef0(X) α Extracting the polynomial X in the form of .v(X))α The zeroth-order coefficient of v(X), i.e., coef0(X) α The ciphertext of .v(X). It's important to note that X appearing in the polynomial can be an indeterminate term, whose function is the constructing polynomial itself.

[0079] A second aspect of the present invention relates to an encrypted communication and processing method, comprising the following steps:

[0080] - The client encrypts message μ using private key s in the form of encrypted message c through an error-learning method;

[0081] - The client transmits encrypted message c or an encrypted database containing encrypted message c to a server that is different from the client and does not have a private key s via a communication channel;

[0082] - The server performs homomorphic processing on the encrypted message c or the encrypted database containing the encrypted message c by the method of the first aspect of the present invention;

[0083] - The server publishes the results of the homomorphic processing.

[0084] According to one embodiment of the encrypted communication and processing method of the second aspect of the present invention, the step of processing an encrypted message includes performing a homomorphic operation on the encrypted message c or a database including the encrypted message. For example, the homomorphic operation may be an addition or multiplication involving the encrypted message c, or a comparison of the encrypted message c with another encrypted message.

[0085] According to one embodiment of the encrypted communication and processing method of the second aspect of the present invention, the step of publishing the result of the homomorphic processing includes publishing a guiding encrypted message c′ or a message generated after performing an operation on the encrypted message.

[0086] A third aspect of the present invention relates to a cryptographic processing server, comprising at least one communication module and a computing module:

[0087] - The communication module is configured to receive encrypted message c or an encrypted database containing encrypted message c from an entity outside the server, where encrypted message c corresponds to message μ encrypted using an error-learning method;

[0088] - The computing module is programmed to perform homomorphic processing on the encrypted message c or an encrypted database containing the encrypted message c according to the method of the first aspect of the invention, without decrypting the message c;

[0089] The communication module is also configured to publish the results of the homomorphic processing.

[0090] A fourth aspect of the invention includes a cryptographic system comprising:

[0091] - A cryptographic processing server according to the second aspect of the present invention;

[0092] - The client is configured to encrypt message μ in the form of encrypted message c and transmit encrypted message c or an encrypted database containing encrypted message c to the server via a communication channel.

[0093] According to one embodiment of the fourth aspect of the invention, the cryptographic system includes multiple clients. Each client may have its own communication channel with the server. Alternatively, two or more clients may share the same communication channel with the server.

[0094] Reading the following description and referring to the accompanying drawings will provide a better understanding of this technology and its various applications. Attached Figure Description

[0095] The accompanying drawings are provided to illustrate the invention and are not intended to limit the scope of the invention in any way.

[0096] [ Figure 1 The diagram illustrates the operation on folding vectors s and a.

[0097] [ Figure 2a This schematically illustrates a guiding method according to a first aspect of the invention;

[0098] [ Figure 2b This schematically illustrates the encrypted transmission and processing method according to the second aspect of the present invention;

[0099] [ Figure 3 ] represents the probability of the accuracy of the guiding method for different values ​​of the folding parameters of vectors s and a.

[0100] [ Figure 4 ] indicates a cryptographic system according to the fourth aspect of the present invention. Detailed Implementation

[0101] [ Figure 1 The diagram illustrates the operation of folding vectors s and a into smaller subvectors. This operation reduces rounding errors when calculating the computational cost α in implementing the method of the first aspect of the invention. Figure 1 In the case of [ ], vectors s and a each have n elements, where the elements of s are integers and the elements of a belong to the torus T. In this example, vectors s and a are folded into ordered subsets of size m. and In general, if n is divisible by m, then there are n / m subsets. and If n is not divisible by m, then the number of subsets is equal to the integer part of n / m plus one subset of s and one subset of a, with a size equal to the remainder of division by n / m. In this case, the calculation of α includes an additional term, which is the scalar product between the two subsets of s and a, with a size equal to the remainder of division by n / m.

[0102] [ Figure 2a [Illustratively illustrating a method for guiding encrypted messages according to a first aspect of the invention] Method 100.

[0103] The method 100 for guiding an encrypted message includes a first step 101: receiving an encrypted message. Here, μ represents the plaintext message. It is important to note that the computing device implementing method 100 does not possess a secret key s. Therefore, an operator with access to the computing module cannot access the message. Decryption is performed.

[0104] The first step 101 of the method 100 according to the first aspect of the invention further includes receiving a publicly encrypted version of the key s. And it is encrypted using key s′. More specifically, the public encrypted version of key s is the function The encrypted form. These functions are Kronecher delta functions: if but In other cases

[0105] The method 100 according to the first aspect of the invention further includes step 102, adjusting the quantity coef0(X) α Perform homomorphic computation on v(X). Step 101 includes homomorphic estimation of the quantity:

[0106]

[0107] in, Calculated as in Where S mm Let S be a set of m tuples whose values ​​are among the possible values ​​of the components of the key. It is a publicly encrypted form in computation.

[0108] The above formula is valid for all multiples of m. Specifically, for m = 1, the expression used in the existing method reappears. For m = n, the calculation of α becomes accurate without any approximations.

[0109] The above equation can be expressed as follows:

[0110]

[0111] Juzhong

[0112] As a result, the product X α v(X) can be homomorphically computed as A sequence of n / m modulo products:

[0113]

[0114] According to one embodiment, the guiding polynomial is A polynomial of type w. j Given by the following formula:

[0115] in

[0116] in It is closest to 2Nm i an integer, and where It is applied to The rounding function.

[0117] As described in the applicant’s patent application PCT / IB2020 / 001147, choosing such a polynomial allows an arbitrary function g to be applied to the encrypted message c during the bootstrapping operation.

[0118] This embodiment significantly speeds up certain data processing procedures. In fact, using polynomial W... q (X) allows homomorphic operations to be performed and encrypted messages to be bootstrapped during the same boot operation.

[0119] The method 100 according to the first aspect of the invention further includes a step 103 of extracting the bootstrap encrypted message c′. Step 103 includes calculating the quantity TLWE based on the secret key s. S (X α v(X)) is the encrypted version of the bootstrap message c′. The encrypted bootstrap message c′ includes a noise component e′, which is smaller than the noise component e associated with message c.

[0120] [ Figure 2b The encrypted communication and processing method 210 is illustrated schematically. The encrypted communication and processing method 210 includes the following steps: the client encrypts the message μ in the form of an encrypted message c using a fault-learning method.

[0121] Then, during transmission step 212, the encrypted message c is transmitted to the server. The encrypted message c is transmitted to a different server than the client.

[0122] The server does not have a private key and is configured to implement homomorphic cryptography by processing the encrypted signal during step 213 without decrypting it.

[0123] Processing step 213 includes, for example, implementing the method 100 according to the first aspect of the invention. According to one embodiment of the encryption and processing method 210, step 213 may further include performing a homomorphic operation on the encrypted message m or a database containing the encrypted message m. Homomorphic operation refers to performing operations such as addition, multiplication, or comparison on the encrypted message without decrypting the message.

[0124] The method 210 according to the second aspect of the invention further includes the step of publishing the result of the homomorphic processing by the server 214.

[0125] [ Figure 3 The graph in the figure illustrates the probability P of the accuracy of the guiding method according to the first aspect of the invention as a function of the standard deviation of random noise σ. Each pair of curves on the graph represents the probability of accuracy of the exact calculation and the approximate calculation of the folding parameter m according to method 100 for values ​​between 1 and 8.

[0126] [ Figure 3 The diagram in [ ] illustrates that for small values ​​of m, the approximation calculated according to method 100 is very close to the accurate calculation, where m is the size of the subvector obtained by folding vectors a and s. As m increases, the calculation results will include less reliable approximations because the number of terms in the rounding and sum increases, and the approximations will deviate from the accurate calculation.

[0127] [ Figure 4 The illustration shows a cryptographic system 400 according to a fourth aspect of the present invention. The cryptographic system 400 includes a cryptographic server 401 according to a second aspect of the present invention. The cryptographic server 401 includes a computing module 402 and a communication module 403.

[0128] Communication module 403 is configured to receive encrypted messages. The public version of the encrypted key s The calculation module 402 is configured to implement the method 100 according to the invention. Specifically, the calculation module is configured to process encrypted messages. Perform a bootstrapping process to obtain an encrypted message c′, where the noise component of c′ is less than the noise component of c.

[0129] According to one embodiment of the cryptographic system 400 of the fourth aspect of the present invention, the computing module 402 is configured to... Homomorphic computation is performed on the modular product sequence in the data.

[0130]

[0131] in,

[0132] The communication module 403 is also configured to transmit a boot message c′ generated by the implementation of the method 210 according to the second aspect of the invention.

[0133] According to one embodiment of the system 400 of the fourth aspect of the present invention, the server 402 is configured to receive and process multiple encrypted messages, such as encrypted databases.

[0134] According to one embodiment of the system 400 of the fourth aspect of the present invention, server 401 is configured to perform homomorphic computations on encrypted messages. For example, server 401 may perform summation, subtraction, or comparison on several encrypted messages. These operations are performed homomorphically, that is, without decryption of the messages.

[0135] When the calculation module 403 performs homomorphic computation on the received encrypted message, it applies the processing method 210 according to the second aspect of the invention to the result of the homomorphic computation. This reduces random noise after the homomorphic computation is performed.

[0136] The cryptographic system 400 according to the present invention also includes a plurality of clients 404, 405, and 406, which can communicate with the server 401 via communication channels 404c, 405c, and 406c. Each communication channel is bidirectional, thereby allowing information to be transmitted from the server 401 to the client and from the client to the server 401.

[0137] Each client is configured to respond to messages with 404, 405, and 406 errors. The message is encrypted and transmitted to server 401 via communication channels 404c, 405c, and 406c. Each client is also configured to receive message c′.

Claims

1. A method for guiding encrypted messages In order to obtain the new version of the encrypted message c′, method (100) is used, μ is the plaintext message, b = μ + e + as, where: -s is a vector containing n elements from a finite set of integers S, and s is the secret key used to encrypt the message μ; -a is a vector containing n randomly selected elements, and a is the projection vector of the secret key s; -e is the random noise component added to μ+as; -c′ includes random noise components e′ whose absolute value is less than the noise e; The method includes homomorphic computation of (102) polynomial X α The zeroth-order coefficients of v(X) are coef0(X). α The steps of .v(X)), where: -v(X) belongs to modulo 1+X N The function-guided polynomial of the defined set of polynomials; - The quantity α corresponds to an approximate estimate of 2N(ba.s), where N is an integer. This approximate estimate comprises the sum of terms, each term including a vector. sum vector Rounding of equal scalar products Includes m ordered elements of vector a, and It includes m corresponding ordered elements of vector s, where k is between the integer parts of 2 and n / m, and m is strictly greater than 1 and less than n.

2. The guiding method (100) according to the preceding claim, characterized in that, The approximate estimation includes homomorphic estimation of the following formula: in, Calculated as function In computation, it is a publicly encrypted form, where And S m It is a set of tuples of size m whose values ​​are in S.

3. The guiding method (100) according to any one of the preceding claims, characterized in that, The method includes step (101): receiving Public encrypted version Encryption is performed using the key s′.

4. The guiding method (100) according to any one of the preceding claims, characterized in that, The method includes step (103): according to the secret key s, using (coef0(X) α Extracting the polynomial X from the ciphertext form of .v(X)) α The zeroth-order coefficients of v(X), TLWE s (coef0(X α .v(X)).

5. An encrypted communication and processing method (210), comprising the following steps: - The client encrypts message μ (211) using private key s in the form of encrypted message c via an error-learning method; - The client transmits the encrypted message c or the encrypted database containing the encrypted message c via the communication channel (212) to a server that is different from the client and does not have the private key s; - The server performs homomorphic processing on the encrypted message c or the encrypted database containing the encrypted message c according to the method described in any one of the preceding claims (213). - The results of the homomorphic processing described in (214) are published by the server.

6. The encrypted communication and processing method (210) according to the preceding claims, characterized in that, The processing step (213) includes performing a homomorphic operation on the ciphertext or on a database containing the encrypted message.

7. A cryptographic processing server (401), comprising at least one communication module (402) and a computing module (403): - The communication module (402) is configured to receive an encrypted message c or an encrypted database containing the encrypted message c from an entity outside the server, the encrypted message c corresponding to the message μ encrypted by an error-learning method; - The computing module (403) is programmed to perform homomorphic processing on the encrypted message c or the encrypted database containing the encrypted message c by the method according to any one of claims 1 to 4; The communication module (402) is also configured to publish the results of the homomorphic processing.

8. A cryptographic system (400), comprising: - The cryptographic processing server (401) according to claim 7; - Client (404, 405, 406), the client is configured to encrypt message μ in the form of encrypted message c, and transmit encrypted message c or an encrypted database containing encrypted message c to the server via communication channels (404c, 405c, 406c).

Images